Data protection damages and tax evader CD

Data protection tax evader CD
Categories:

Does the authority have to respect data protection with the tax evader CD?

Imagine the following fictitious case: German authorities purchase a CD containing personal data of actual and/or alleged tax evaders.

The seller is, for example, a bank employee who has stored personal bank data from the bank's systems without authorization and then offered this data pool for sale to the tax authorities. On the basis of this data, criminal tax proceedings are later initiated and tax arrears are assessed. Under data protection law, the collection, processing and use of personal data is only permitted within the framework of a narrow Earmarking is permissible (§ 28 BDSG).

The Transmission and use of such data for another purpose is in principle also permitted for the pursuit of Criminal offenses permissible. However, criminal prosecution is tied to formal proceedings. Therefore, formal investigation proceedings are usually initiated if there is an initial suspicion.

This was not the case for those affected by the data pool. Therefore, the purchase of the data did not take place as part of a specific investigation and the Transmission and use of the data would be inadmissible. The unauthorized collection or use of personal data makes the responsible However, the data controller is liable for damages (§ 7 BDSG).

I.e. all financial disadvantages which the Affected parties -in this case the bank customer- as a result of the unauthorized data collection, Processing or use are damages eligible for compensation. If several parties, such as the bank or bank employees, have acted unlawfully, they are jointly and severally liable. In this respect, the question arises as to whether affected tax evaders, for example, can make the tax authorities liable for damages as the purchaser of the data CD, because fiscal interests are not a reason § 28 para. 3 BDSG, the strict Earmarking of the acquired bank data.

In addition to any procedural costs and fines, it may even be necessary to examine the possibility of compensation for damages, as provided for in various state data protection laws. Affected parties and consultants will not ignore the data protection aspects when defending against claims or justifying recourse. Companies take appropriate measures at an early stage to protect themselves against data theft and are aware of the risk of data misuse by employees. Some companies keep databases that are used for Third interesting and whose sale could be a great temptation for employees. Even in the event of data theft, a company must expect claims from those affected if security measures have not been taken against this.

Tags:
Share this post :